Attribute-based encrypted data sharing system and method supporting flexible change of user

Abstract

The invention discloses an attribute-based encrypted data sharing system supporting flexible change of a user. The attribute-based encrypted data sharing system comprises a central authority CA, generating and issuing public parameters, generating a first key component and an authority amount, and initiating attribute revocation; the attribute authority AA is used for generating a pre-decryption key, an attribute quantity and a new pre-decryption key, and updating a key component; the data owner DO provides a user public key, a first attribute set, an index, a blind keyword and an initial ciphertext; the proxy server PS generates a keyword search trap door and a final ciphertext, verifies the search request, downloads the corresponding final ciphertext for pre-decryption after the search request passes the verification, and outputs a pre-decrypted ciphertext; the cloud service provider CSP stores the final ciphertext; and the DU generates and sends a second attribute set, initiates a search request based on a keyword search trap door, and receives and decrypts the pre-decrypted ciphertext. The access control and sharing utilization of the data by the data owner are realized, and meanwhile, the forward security and instantaneity of the user after revocation are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to an attribute-based encrypted data sharing system and method that supports flexible user changes. Background Art

[0002] In the cloud storage scenario, data owners upload data after creating storage space on the cloud platform and set access permissions for the data. The main existing access control methods include access control lists (ACLs) and identity and access management (IAM). Under this access control method, the verifier of access permissions is the access control system of the cloud storage service provider, and there is a possibility that the cloud storage service provider may snoop on user data.

[0003] Attribute-based encryption can effectively solve the problem of access control subjects by using attributes for access control. In data sharing scenarios, there are situations where user identities change, which involves attribute revocation. The existing revocable attribute scheme does not provide sufficient support for ensuring the forward security of the system. At the same time, encrypting the data makes it impossible to directly search or query the data in the ciphertext state. Searchable encryption introduces a specific encrypted keyword index structure into the encrypted data, so that the ciphertext can still be effectively searched by keywords in the encrypted state.

[0004] Prior art CN117997604A proposes a data access control system that supports attribute revocation and uses attribute-based encryption, and uses blockchain to assist in authority verification. However, it performs key control based on versions, and after revocation, it is necessary to update the version number and the attribute keys of all unrevoked users; Prior art CN114095160A proposes to achieve revocation by embedding timestamps in ciphertexts, and unrevoked users accept key update materials related to timestamps generated by authorized agencies. This method also does not achieve instant revocation; Prior art CN117521118A proposes a medical data searchable encrypted privacy protection and system, whose ciphertext files and index files are separate, so the computational workload and storage overhead are large. Its encryption key and index key are also separate, so the key length is too long.

[0005] The main problem in the existing research on revocable attribute-based encryption is that after user revocation, in order to ensure that the revoked user cannot continue to decrypt the corresponding data with the key before revocation, the ciphertext needs to be re-encrypted, which results in a large computational overhead. Another problem is that the granularity of revocation is insufficient, and some methods only support user-level or system-level revocation. In the research on searchable encryption, the main shortcoming is that the expressive power of keywords is not strong. Some schemes only support single keyword search, and some schemes only support the connection of keywords using a single logical connector (and or or). There is also the problem of long ciphertext length and large search calculation. The existing attribute-based encryption schemes that support both attribute revocation and searchability have high computational overhead, long ciphertext length, and revocation is not instant.

[0006] Therefore, how to achieve data owner access control and shared use of data while ensuring forward security and immediacy after user revocation is an issue that technical personnel in this field urgently need to solve. Summary of the invention

[0007] In view of this, the present invention provides an attribute-based encrypted data sharing system and method that supports flexible user changes, which at least partially solves the problems existing in the prior art, realizes the access control and shared use of data by data owners, and at the same time ensures forward security and immediacy after user revocation.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] An attribute-based encrypted data sharing system that supports flexible user changes includes: a central authority CA, an attribute authority AA, a data owner DO, a proxy server PS, a cloud service provider CSP and a data user DU;

[0010] The central authority CA generates and publishes public parameters, generates the first key component and the authority amount, and initiates attribute revocation;

[0011] The attribute authority AA generates a pre-decryption key, an attribute amount and a new pre-decryption key, and updates the key component;

[0012] The data owner DO provides a user public key, a first attribute set, an index, a blinded keyword, and an initial ciphertext;

[0013] The proxy server PS generates a keyword search trapdoor and a final ciphertext, verifies the search request, pre-decrypts the corresponding final ciphertext downloaded through post-search, and outputs the pre-decrypted ciphertext;

[0014] The cloud service provider CSP stores the final ciphertext;

[0015] The data user DU generates and sends a second attribute set, initiates a search request based on the keyword search trapdoor, and receives and decrypts the pre-decrypted ciphertext.

[0016] Preferably, the central authority CA specifically includes:

[0017] Randomly generate security parameters, generate the public parameters based on the security parameters, and send them to the AA, PS, and DO respectively;

[0018] Generate the authoritative quantity based on the attribute quantity and send it to the PS;

[0019] generating the first key component based on the user public key and the public parameter;

[0020] receiving the first set of attributes;

[0021] Generate attributes to be revoked;

[0022] The first key component, the first attribute set, and the attributes to be revoked are sent to the AA.

[0023] Preferably, the attribute authority AA specifically includes:

[0024] Generate a pre-decryption key based on the public parameter, the first attribute set and the first key component, and send the pre-decryption key to the PS;

[0025] generating attribute quantities based on the second attribute set, and sending the attributes to the CA;

[0026] The new pre-decryption key is generated based on the attribute to be revoked, the pre-decryption key and the public parameter, and sent to the PS.

[0027] Randomly select the first attribute parameter u based on the jth attribute in the AA attribute domain dj , and calculate the second attribute parameter based on the first attribute parameter;

[0028] After the new pre-decryption key is generated, the key component is updated for the user who has the attribute to be revoked and has not been revoked based on the second attribute parameter.

[0029] Preferably, the data owner DO specifically includes:

[0030] Generate the user public key and the first attribute set and send them to the CA;

[0031] Select multiple keywords based on the semantics of the plaintext to be encrypted;

[0032] generating the index based on the keyword and the common parameter;

[0033] Perform blinding processing based on the keywords to obtain the blinded keywords;

[0034] Constructing an access policy, and generating the initial ciphertext based on the access policy, the plaintext to be encrypted and the public parameters;

[0035] The index, the blinded keyword and the initial ciphertext are sent to the PS.

[0036] Preferably, the proxy server PS specifically comprises:

[0037] Generate the final ciphertext based on the public parameters and the initial ciphertext, and send it to the CSP;

[0038] generating the keyword search trapdoor based on the blinded keyword, the public parameter and the pre-decryption key;

[0039] Performing authority judgment based on the second attribute set, the authoritative amount, and the pre-decryption key, and when the access policy is satisfied, searching and downloading the final ciphertext in the CSP based on the keyword search trapdoor, the public parameter, and the index;

[0040] Generate the pre-decrypted ciphertext based on the final ciphertext, the public parameter and the pre-decryption key;

[0041] The keyword search trapdoor and the pre-decrypted ciphertext are sent to the DU.

[0042] Preferably, the data user DU specifically includes:

[0043] generating the search request based on the keyword search trapdoor;

[0044] Generate a second attribute set and use the private key;

[0045] sending the search request and the second attribute set to a PS;

[0046] The pre-decrypted ciphertext is decrypted based on the private key to obtain the corresponding plaintext.

[0047] An attribute-based encrypted data sharing method supporting flexible user changes, comprising:

[0048] CA generates public parameters; DO generates a user public key and a first attribute set; CA generates a first key component based on the user public key; AA generates a pre-decryption key based on the public parameters, the first key component and the first attribute set;

[0049] DO constructs an access policy and generates an initial ciphertext based on the access policy, the plaintext to be encrypted and the public parameters; PS generates a final ciphertext based on the initial ciphertext and the pre-decryption key and sends it to CSP for storage;

[0050] The DO generates an index and a blinded keyword based on the plaintext to be encrypted; the PS generates a keyword search trap based on the blinded keyword, the public parameter and the pre-decryption key and sends it to the DU;

[0051] The DU generates a second attribute set and uses a private key to generate a search request based on the keyword search trapdoor; the AA generates an attribute quantity based on the second attribute set, and the CA generates an authoritative quantity based on the attribute quantity;

[0052] After receiving the search request, the PS performs permission judgment based on the second attribute set, the authoritative amount and the pre-decryption key. When the access policy is satisfied, the PS obtains the final ciphertext in the CSP based on the keyword search trapdoor, the public parameter and the index, and performs pre-decryption to obtain the pre-decrypted ciphertext.

[0053] The DU decrypts the pre-decrypted ciphertext based on the private key to obtain the corresponding plaintext;

[0054] The CA generates the attribute to be revoked and sends it to the AA; the AA generates a new pre-decryption key based on the attribute to be revoked, the pre-decryption key and the public parameter, and updates the key component for the user who has the attribute to be revoked and has not been revoked.

[0055] Preferably, generating common parameters specifically includes:

[0056] CA randomly generates security parameters;

[0057] Running a group generation algorithm based on the security parameter as input, selecting a bilinear group G whose order is a prime number p;

[0058] Select a prime number q such that gcd(p,q)=1;

[0059] Based on the prime number p and the prime number q, the intermediate quantity N=pq is obtained;

[0060] Define X as a global attribute set containing h attributes;

[0061] Select a first hash function H;

[0062] Obtain a second hash function H1 based on the global attribute set and the bilinear group G;

[0063] Randomly select the first parameter α and the second parameter β;

[0064] The public parameter PP=(β, g, g1) is obtained based on the intermediate quantity N, the first Hash function H, and the second Hash function H2. α ,e(g,g) α ,H,H1,N);

[0065] Among them, g represents the generator of the bilinear group G, and e represents the bilinear pairing operation.

[0066] Preferably, generating a pre-decryption key specifically includes:

[0067] Select a random number c, c∈Z N * ;

[0068] CA obtains a first key component K1 based on the user public key K, the public parameter and the random number;

[0069] Each of the attribute authorities calculates the first process quantity K for the first attribute set in the attribute domain managed by each of them 2,d and the second process quantity K 3,d ;

[0070] Obtaining a second key component K2 based on the first process quantity;

[0071] Obtaining a third key component K3 based on the second process quantity;

[0072] Based on the random number c as the fourth key component K4;

[0073] The pre-decryption key sk is obtained based on the first key component, the second key component, the third key component and the fourth key component id,pre =(K1,K2,K3,K4).

[0074] Preferably, generating a new pre-decryption key specifically includes:

[0075] The attribute authority responsible for managing the attribute to be revoked updates the second key component and the third key component based on the public parameter, the pre-decryption key and the attribute to be revoked, respectively, to obtain a second updated key component and a third updated key component accordingly;

[0076] The second key component and the third key component in the pre-decryption key are replaced based on the second updated key component and the third updated key component to obtain the new pre-decryption key.

[0077] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses an attribute-based encrypted data sharing system and method that supports flexible user changes, which has the following beneficial effects:

[0078] 1. Flexible change of users: The system designed by the present invention supports flexible change of users, including partial attribute revocation, attribute addition, new user and revocation of the entire user for a specific user. When changing the user, it does not affect the ciphertext stored in the system. This revocation operation is immediate, rather than scheduled, to ensure data security and timeliness of access control.

[0079] 2. Low computational overhead on the decryption end: The algorithm designed by the present invention has very little overhead on the decryption end, requiring only one exponential operation. Most of the decryption computational overhead is performed by the proxy server. Therefore, the decryption end is suitable for low-computing power platforms such as mobile devices and Internet of Things devices.

[0080] 3. Security and scalability of multiple authorities: The present invention adopts multiple authorities, and its distributed security mechanism reduces the risk of a single authority being breached by a single point. At the same time, multiple authorities manage their own attribute domains respectively, which is better suited to the characteristics of cloud storage environments where attributes are prone to change, and the expansion and management of system attribute domains are more convenient.

[0081] 4. The present invention allows searching and querying data in an encrypted state without decrypting the data. Through searchable encryption technology, users can perform efficient searches while protecting data security, while ensuring that data is fully protected during the search process.

[0082] 5. The present invention does not need to update the stored ciphertext after the user revokes it, which ensures forward security and immediacy. Even if the user's access rights to certain data are revoked, the previously encrypted data can still be effectively protected, and there is no need to modify the stored data, which improves the efficiency of revocation.

[0083] 6. In traditional cloud storage services, the subject of access control is often the cloud storage service provider. In the present invention, the subject of access control is the data owner. This change reduces the security risks faced by data due to the semi-honesty of cloud service providers, and data owners can better control the access rights to their data. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0085] Figure 1 A schematic diagram of the structure of an attribute-based encrypted data sharing system that supports flexible changes by users provided by the present invention.

[0086] Figure 2 The present invention provides an overall framework diagram of an attribute-based encrypted data sharing system that supports flexible user changes.

[0087] Figure 3 A flow chart of an attribute-based encrypted data sharing method supporting flexible changes by users provided by the present invention.

[0088] Figure 4 This is a schematic diagram of the user registration process provided by the present invention.

[0089] Figure 5 A schematic diagram of the ciphertext search process provided by the present invention. DETAILED DESCRIPTION

[0090] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0091] Example 1

[0092] like Figure 1 As shown, an embodiment of the present invention discloses an attribute-based encrypted data sharing system that supports flexible user changes, including: a central authority CA, an attribute authority AA, a data owner DO, a proxy server PS, a cloud service provider CSP and a data user DU;

[0093] The central authority CA generates and publishes public parameters, generates the first key component and the authority amount, and initiates attribute revocation;

[0094] The attribute authority AA generates the pre-decryption key, the attribute amount and the new pre-decryption key, and updates the key component;

[0095] The data owner DO provides the user public key, the first attribute set, the index, the blinded keyword and the initial ciphertext;

[0096] The proxy server PS generates a keyword search trapdoor and final ciphertext, verifies the search request, pre-decrypts the corresponding final ciphertext downloaded through post-search, and outputs the pre-decrypted ciphertext;

[0097] The cloud service provider CSP stores the final ciphertext;

[0098] The data user DU generates and sends a second attribute set, initiates a search request based on a keyword search trapdoor, and receives and decrypts the pre-decrypted ciphertext.

[0099] Example 2

[0100] like Figure 2 As shown, an embodiment of the present invention discloses an attribute-based encrypted data sharing system that supports flexible changes by users, including: a central authority (CA), attribute authorities (AA), a data owner (DO), a proxy server (PS), a data user (DU) and a cloud service provider (CSP);

[0101] The central authority CA is used to generate and publish public parameters, generate the first key component and the authority, and initiate attribute revocation.

[0102] Preferably, the central authority CA has the following functions:

[0103] Randomly generate security parameters, generate public parameters based on the security parameters and send them to AA, PS and DO respectively;

[0104] Generate authoritative quantities based on attribute quantities and send them to PS;

[0105] generating a first key component based on a user public key and a public parameter;

[0106] receiving a first set of attributes;

[0107] Generate attributes to be revoked;

[0108] The first key component, the first attribute set and the attributes to be revoked are sent to the AA.

[0109] Preferably, generating common parameters specifically includes:

[0110] CA randomly generates security parameter λ;

[0111] Run the group generation algorithm based on the security parameter λ as input and select a bilinear group G with a prime order p;

[0112] Select a prime number q that satisfies gcd(p,q)=1, where gcd() means taking the greatest common divisor;

[0113] Based on the prime number p and the prime number q, the intermediate quantity N=pq is obtained;

[0114] Define X as a global attribute set containing h attributes, X = {x1, x2, ..., x h};

[0115] Select the first hash function H, H:Z N →{0,1} * ;

[0116] Based on the global attribute set and the bilinear group G, the second hash function H1 is obtained, H1:X→G;

[0117] Randomly select the first parameter α and the second parameter β, α and β∈Z N * ;

[0118] Based on the intermediate quantity N, the first Hash function H, and the second Hash function H1, a public parameter PP is obtained: PP = (β, g, g α ,e(g,g) α ,H,H1,N);

[0119] Among them, g represents the generator of the bilinear group G, and e represents the bilinear pairing operation.

[0120] Preferably, generating the first key component specifically includes:

[0121] Select a random number c, c∈Z N * ;

[0122] CA obtains the first key component K1 based on the user public key K, the public parameter PP and the random number c:

[0123] K1=K α g βc .

[0124] Preferably, based on the attribute quantity u d 'Generate authority u', specifically including:

[0125]

[0126] Wherein, m represents the number of authoritative attributes, and d represents the index value of the authoritative attribute.

[0127] The attribute authority AA is used to generate pre-decryption keys, attribute quantities and new pre-decryption keys, and update key components.

[0128] Preferably, the attribute authority AA has the following functions:

[0129] Generate a pre-decryption key based on the public parameter, the first attribute set and the first key component, and send the pre-decryption key to the PS;

[0130] generating attribute quantities based on the second attribute set and sending the attributes to the CA;

[0131] A new pre-decryption key is generated based on the attribute to be revoked, the pre-decryption key and the public parameters, and sent to the PS.

[0132] Randomly select the first attribute parameter u based on the jth attribute in the AA attribute domain dj, and calculate the second attribute parameter based on the first attribute parameter;

[0133] After the new pre-decryption key is generated, the key component is updated for the user who has the attribute to be revoked but has not been revoked based on the second attribute parameter.

[0134] Preferably, generating a pre-decryption key specifically includes:

[0135] Select a random number c, c∈Z N * ;

[0136] CA obtains the first key component K1 based on the user public key K, public parameters and random numbers;

[0137] Each attribute authority calculates the first process quantity K for the first attribute set in the attribute domain managed by it 2,d and the second process quantity K 3,d ;

[0138] Obtaining a second key component K2 based on the first process quantity;

[0139] Obtaining a third key component K3 based on the second process quantity;

[0140] Based on the random number c as the fourth key component K4;

[0141] A pre-decryption key sk is obtained based on the first key component, the second key component, the third key component and the fourth key component id,pre =(K1,K2,K3,K4).

[0142] Preferably, the first process quantity K 2,d ={H1(ρ(i))} c ; The second process quantity K 3,d :

[0143]

[0144] Among them, ρ(i) represents the attribute expression of the first attribute set, v i Indicates the second attribute parameter;

[0145] Based on the first process quantity K 2,d Get the second key component K2: K2 = {K 2,d |d=1,2,...,m};

[0146] Based on the second process quantity K 3,d Get the third key component K3: K3 = K 3,m , where K 3,m Represents the second process quantity K 3,d The maximum value in .

[0147] Preferably, generating the attribute quantity based on the second attribute set specifically includes:

[0148] Each AA uses the second attribute set S' to manage the attribute x in the attribute domain it manages. j , calculate the attribute quantity u d ':

[0149]

[0150] Preferably, generating a new pre-decryption key based on the attribute to be revoked, the pre-decryption key and the public parameter specifically includes:

[0151] The attribute authority responsible for managing the attribute to be revoked updates the second key component and the third key component based on the public parameter, the pre-decryption key and the attribute to be revoked, respectively, to obtain a second updated key component and a third updated key component respectively;

[0152] The second key component and the third key component in the pre-decryption key are replaced based on the second updated key component and the third updated key component to obtain a new pre-decryption key.

[0153] Preferably, the second updated key component K2' is: K2'=K2 / H1(x j )K 4 , the third updated key component K3' is: where x j Indicates the attribute to be revoked.

[0154] Preferably, the second attribute parameter v dj Satisfy v dj u dj ≡1(modN), and then get the second attribute parameter v dj .

[0155] Preferably, obtaining the user update key component specifically includes:

[0156] Regenerate the first new attribute parameter u based on the attribute to be revoked dj ',u dj '≠u dj ;

[0157] Based on the first new attribute parameter u dj 'Get the second new attribute parameter v dj ',v dj 'u dj '≡1(modN);

[0158] The third key component is updated based on the first new attribute parameter and the second new attribute parameter to obtain an updated key K3': The other key components remain unchanged.

[0159] The present invention does not need to update the stored ciphertext after revocation, thus ensuring forward security and immediacy. Even if the user revokes the access rights to certain data, the previously encrypted data can still be effectively protected, and there is no need to modify the stored data, thus improving the efficiency of revocation.

[0160] Preferably, the attribute authority AA is also used to generate a public-private key pair of the attribute authority based on the public parameters and the index value d:

[0161] Randomly select the first element y in the integer field d and the second element k d As the attribute private key SK d ;

[0162] Based on the attribute private key SK d Calculate the attribute public key PK d = {g yd ,g kd};

[0163] Based on the generated attribute private key and attribute public key, encrypted communication with the central authority CA is achieved to avoid information leakage.

[0164] The data owner DO is used to provide the user public key, the first attribute set, the index, the blinded keyword and the initial ciphertext.

[0165] Preferably, the data owner DO has the following functions:

[0166] Generate a user public key and a first attribute set and send them to the CA;

[0167] Select multiple keywords based on the semantics of the plaintext to be encrypted;

[0168] Generate indexes based on keywords and common parameters;

[0169] Perform blinding processing based on keywords to obtain blinded keywords;

[0170] Build access policies and generate initial ciphertext based on the access policies, plaintext to be encrypted and public parameters;

[0171] Send the index, blinded keywords and initial ciphertext to PS.

[0172] Preferably, generating a user public key specifically includes:

[0173] Randomly select a natural number k∈Z N * As the user's private key sk id = k;

[0174] Based on the user's private key sk id Calculate the user's public key

[0175] Preferably, the first attribute set S = {ρ(i)∈P|i∈{1,2,...,L}}, where a user has one attribute corresponding to one ρ(i).

[0176] Preferably, the blinding process is: selecting a random number B, and calculating the Bth power of the keyword.

[0177] Preferably, generating the initial ciphertext specifically includes:

[0178] Create an access policy with a set of attributes Q;

[0179] Based on the access strategy, generate a secret sharing matrix U with l rows and n columns and a mapping ρ, map each row in the matrix U to a participant, and obtain Q = {ρ(i)∈X|i=1,2,...,L};

[0180] The data owner randomly selects a secret value Y∈Z for Q q ; Based on the linear secret sharing scheme, we get the shared vector t=(t1,...t L );

[0181] Based on the shared vector, the plaintext to be encrypted and the public parameters, the first initial ciphertext component C1, the second initial ciphertext component C2, and the third initial ciphertext component C i,1 and the fourth initial ciphertext component C i,2 :

[0182]

[0183] Based on components C1, C2, C i1 and C i2 Get the initial ciphertext C m,pre =(C1,C2,C i,1 ,C i,2 ).

[0184] The proxy server PS is used to generate keyword search trapdoors and final ciphertexts, verify search requests, pre-decrypt the corresponding final ciphertexts downloaded through post-search, and output pre-decrypted ciphertexts.

[0185] Preferably, the proxy server PS specifically includes the following functions:

[0186] Generate the final ciphertext based on the public parameters and the initial ciphertext, and send it to the CSP;

[0187] Generate a keyword search trapdoor based on blinded keywords, public parameters and pre-decryption keys;

[0188] Based on the second attribute set, the authority amount and the pre-decryption key, the permission judgment is performed. When the access policy is met, the final ciphertext is downloaded in the CSP based on the keyword search trap, public parameters and index;

[0189] Generate a pre-decrypted ciphertext based on the final ciphertext, the public parameter and the pre-decryption key;

[0190] The keyword search trapdoor and pre-decrypted ciphertext are sent to DU.

[0191] Preferably, generating the final ciphertext based on the public parameters and the initial ciphertext specifically includes:

[0192] Randomly select values ​​r1,r2,...,r l ∈Z N ;

[0193] Calculate the fifth initial ciphertext component C based on the selected value i,3 and the sixth initial ciphertext component C i,4 :

[0194]

[0195] Based on the fifth initial ciphertext component C i,3 Replace the fourth initial ciphertext component with the sixth initial ciphertext component Ci,4 to obtain the final ciphertext: C m =(C1,C2,C i,1 ,C i,3 ,C i,4 ).

[0196] Preferably, the authority determination process is:

[0197] Generate attribute matrix M based on the second attribute set S' S’ ;

[0198] Based on the formula wM S’ =(1,0,...,0) to get the attribute vector w;

[0199] Get the component value w based on the attribute vector w i

[0200] Based on the composition value w i , authoritative quantity u' and pre-decryption key sk id,pre Get the permission judgment expression:

[0201]

[0202] When the expressions are equal, it indicates that the second attribute set of the data user satisfies the access policy in the ciphertext and the verification succeeds; otherwise, the verification fails and the verification process is terminated.

[0203] Preferably, the pre-decrypted ciphertext F is:

[0204]

[0205] The cloud service provider CSP stores the final ciphertext.

[0206] The data user DU generates and sends a second attribute set, initiates a search request based on a keyword search trapdoor, and receives and decrypts the pre-decrypted ciphertext.

[0207] Preferably, the data user DU specifically includes:

[0208] Generate search requests based on keyword search trapdoors;

[0209] Generate a second attribute set and use the private key;

[0210] sending the search request and the second attribute set to the PS;

[0211] Based on the use of the private key to decrypt the pre-decrypted ciphertext, the corresponding plaintext W is obtained.

[0212] Preferably, the plaintext W is:

[0213]

[0214] Here, k' indicates the use of the private key.

[0215] Example 3

[0216] like Figure 3 As shown, an attribute-based encrypted data sharing method that supports flexible user changes includes:

[0217] CA generates public parameters; DO generates a user public key and a first attribute set; CA generates a first key component based on the user public key; AA generates a pre-decryption key based on the public parameters, the first key component and the first attribute set;

[0218] DO builds access policy and generates initial ciphertext based on access policy, plaintext to be encrypted and public parameters; PS generates final ciphertext based on initial ciphertext and pre-decryption key and sends it to CSP for storage;

[0219] DO generates indexes and blinded keywords based on the plaintext to be encrypted; PS generates keyword search traps based on blinded keywords, public parameters and pre-decryption keys and sends them to DU;

[0220] DU generates a second attribute set and uses a private key to generate a search request based on a keyword search trapdoor; AA generates an attribute quantity based on the second attribute set, and CA generates an authoritative quantity based on the attribute quantity;

[0221] After receiving the search request, the PS makes a permission judgment based on the second attribute set, the authority amount and the pre-decryption key. When the access policy is met, the PS searches for the trapdoor based on the keyword, the public parameter and the index to obtain the final ciphertext in the CSP, and performs pre-decryption to obtain the pre-decrypted ciphertext.

[0222] DU decrypts the pre-decrypted ciphertext based on the private key and obtains the corresponding plaintext;

[0223] The CA generates the attribute to be revoked and sends it to the AA; the AA generates a new pre-decryption key based on the attribute to be revoked, the pre-decryption key and the public parameters, and updates the key component for the user whose attribute to be revoked has not been revoked.

[0224] Preferably, generating common parameters specifically includes:

[0225] CA randomly generates security parameters;

[0226] Run the group generation algorithm based on the security parameter as input, and select a bilinear group G with a prime order p;

[0227] Select a prime number q such that gcd(p,q)=1;

[0228] Based on the prime number p and the prime number q, the intermediate quantity N=pq is obtained;

[0229] Define X as a global attribute set containing h attributes;

[0230] Select a first hash function H;

[0231] Obtain a second hash function H1 based on the global attribute set and the bilinear group G;

[0232] Randomly select the first parameter α and the second parameter β;

[0233] Based on the intermediate quantity N, the first Hash function H, and the second Hash function H1, a public parameter PP is obtained: PP = (β, g, g α ,e(g,g) α ,H,H1,N);

[0234] Among them, g represents the generator of the bilinear group G, and e represents the bilinear pairing operation.

[0235] Preferably, generating a pre-decryption key specifically includes:

[0236] Select a random number c, c∈Z N * ;

[0237] CA obtains the first key component K1 based on the user public key K, public parameters and random numbers;

[0238] Each attribute authority calculates the first process quantity K for the first attribute set in the attribute domain managed by it 2,d and the second process quantity K 3,d ;

[0239] Obtaining a second key component K2 based on the first process quantity;

[0240] Obtaining a third key component K3 based on the second process quantity;

[0241] Based on the random number c as the fourth key component K4;

[0242] A pre-decryption key sk is obtained based on the first key component, the second key component, the third key component and the fourth key component id,pre =(K1,K2,K3,K4).

[0243] Preferably, generating a new pre-decryption key specifically includes:

[0244] The attribute authority responsible for managing the attribute to be revoked updates the second key component and the third key component based on the public parameter, the pre-decryption key and the attribute to be revoked, respectively, to obtain a second updated key component and a third updated key component accordingly;

[0245] The second key component and the third key component in the pre-decryption key are replaced based on the second updated key component and the third updated key component to obtain a new pre-decryption key.

[0246] Preferably, Figure 4 As shown, the user registration process is:

[0247] DO generates a user public key and a first attribute set and sends them to CA;

[0248] The CA generates a first key component based on the user public key, generates a unique identity for the DO, and sends the first key component and the identity to the AA;

[0249] The AA generates a pre-decryption key based on the public parameter, the first key component and the first attribute set, and sends the pre-decryption key and the identity to the PS;

[0250] The PS saves the pre-decryption key and identity, and creates a mapping table between the identity and the pre-decryption key to complete user registration.

[0251] Preferably, Figure 5 As shown in the figure, the ciphertext search process is:

[0252] DO selects a plurality of keywords based on the semantics of the plaintext to be encrypted;

[0253] Generate an index based on the keyword and the common parameter, and perform blinding processing based on the keyword to obtain a blinded keyword;

[0254] The PS generates a keyword search trapdoor based on the blinded keyword, public parameters, and pre-decryption key and sends it to the DU;

[0255] DU generates a second attribute set and sends it to AA, and generates a search request based on the keyword search trap and sends it to PS;

[0256] AA generates attribute quantity based on the second attribute set and sends it to CA;

[0257] CA generates authoritative quantity based on attribute quantity and sends it to PS;

[0258] After receiving the search request, the PS makes a permission judgment based on the second attribute set, the authority amount, and the pre-decryption key. When the access policy is met, the PS searches for the trapdoor, public parameters, and indexes in the CSP to obtain the final ciphertext.

[0259] PS performs pre-decryption based on the final ciphertext, obtains the pre-decrypted ciphertext and sends it to DU;

[0260] DU receives the pre-decrypted ciphertext and completes the search process.

[0261] Preferably, the attribute authority AA is also used to generate a public-private key pair of the attribute authority based on the public parameters and the index value d:

[0262] Randomly select the first element y in the integer field d and the second element k d As the attribute private key SK d ;

[0263] Based on the attribute private key SK d Calculate the attribute public key PK d = {g yd ,g kd};

[0264] Based on the generated attribute private key and attribute public key, encrypted communication with the central authority CA is achieved to avoid information leakage.

[0265] Example 4

[0266] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0267] Memory, used to store computer programs;

[0268] The processor, when used to execute the program stored in the memory, can implement an attribute-based encrypted data sharing method that supports flexible user changes as in Example 3.

[0269] The electronic device may include: a processor, a communications interface, a memory and a communications bus, wherein the processor, the communications interface and the memory communicate with each other via the communications bus.

[0270] The processor can call the logic instructions in the memory to execute an attribute-based encrypted data sharing method in Example 3 that supports flexible user changes.

[0271] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0272] It can be seen from the above technical solutions that the present invention discloses an attribute-based encrypted data sharing system and method that supports flexible changes by users, which has the following beneficial effects:

[0273] 1. Flexible change of users: The system designed by the present invention supports flexible change of users, including partial attribute revocation, attribute addition, new user and revocation of the entire user for a specific user. When changing the user, it does not affect the ciphertext stored in the system. This revocation operation is immediate, rather than scheduled, to ensure data security and timeliness of access control.

[0274] 2. Low computational overhead on the decryption end: The algorithm designed by the present invention has very little overhead on the decryption end, requiring only one exponential operation. Most of the decryption computational overhead is performed by the proxy server. Therefore, the decryption end is suitable for low-computing power platforms such as mobile devices and Internet of Things devices.

[0275] 3. Security and scalability of multiple authorities: The present invention adopts multiple authorities, and its distributed security mechanism reduces the risk of a single authority being breached by a single point. At the same time, multiple authorities manage their own attribute domains respectively, which is better suited to the characteristics of cloud storage environments where attributes are prone to change, and the expansion and management of system attribute domains are more convenient.

[0276] 4. The present invention allows searching and querying data in an encrypted state without decrypting the data. Through searchable encryption technology, users can perform efficient searches while protecting data security, while ensuring that data is fully protected during the search process.

[0277] 5. The present invention does not need to update the stored ciphertext after the user revokes it, which ensures forward security and immediacy. Even if the user's access rights to certain data are revoked, the previously encrypted data can still be effectively protected, and there is no need to modify the stored data, which improves the efficiency of revocation.

[0278] 6. In traditional cloud storage services, the subject of access control is often the cloud storage service provider. In the present invention, the subject of access control is the data owner. This change reduces the security risks faced by data due to the semi-honesty of cloud service providers, and data owners can better control the access rights to their data.

[0279] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0280] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An attribute-based encrypted data sharing system that supports flexible user changes, characterized in that: include: Central authority CA, attribute authority AA, data owner DO, proxy server PS, cloud service provider CSP and data user DU; The central authority CA generates and publishes public parameters, generates the first key component and the authority amount, and initiates attribute revocation; The attribute authority AA generates a pre-decryption key, an attribute amount and a new pre-decryption key, and updates the key component; The data owner DO provides a user public key, a first attribute set, an index, a blinded keyword, and an initial ciphertext; The proxy server PS generates a keyword search trap and a final ciphertext, verifies the search request, pre-decrypts the corresponding final ciphertext downloaded through post-search, and outputs the pre-decrypted ciphertext; The cloud service provider CSP stores the final ciphertext; The data user DU generates and sends a second attribute set, initiates a search request based on the keyword search trapdoor, and receives and decrypts the pre-decrypted ciphertext.

2. According to claim 1, an attribute-based encrypted data sharing system that supports flexible user changes is characterized in that: The central authority CA specifically includes: Randomly generate security parameters, generate the public parameters based on the security parameters, and send them to the AA, PS, and DO respectively; Generate the authoritative quantity based on the attribute quantity and send it to the PS; generating the first key component based on the user public key and the public parameter; receiving the first set of attributes; Generate attributes to be revoked; The first key component, the first attribute set, and the attributes to be revoked are sent to the AA.

3. The attribute-based encrypted data sharing system supporting flexible user changes according to claim 2, characterized in that: The attribute authority AA specifically includes: Generate a pre-decryption key based on the public parameter, the first attribute set and the first key component, and send the pre-decryption key to the PS; generating attribute quantities based on the second attribute set, and sending the attributes to the CA; The new pre-decryption key is generated based on the attribute to be revoked, the pre-decryption key and the public parameter, and sent to the PS. Randomly select the first attribute parameter u based on the jth attribute in the AA attribute domain dj , and calculate the second attribute parameter based on the first attribute parameter; After the new pre-decryption key is generated, the key component is updated for the user who has the attribute to be revoked and has not been revoked based on the second attribute parameter.

4. The attribute-based encrypted data sharing system supporting flexible user changes according to claim 3, characterized in that: The data owner DO specifically includes: Generate the user public key and the first attribute set and send them to the CA; Select multiple keywords based on the semantics of the plaintext to be encrypted; generating the index based on the keyword and the common parameter; Perform blinding processing based on the keywords to obtain the blinded keywords; Constructing an access policy, and generating the initial ciphertext based on the access policy, the plaintext to be encrypted and the public parameters; The index, the blinded keyword and the initial ciphertext are sent to the PS.

5. The attribute-based encrypted data sharing system supporting flexible user changes according to claim 4, characterized in that: The proxy server PS specifically includes: Generate the final ciphertext based on the public parameters and the initial ciphertext, and send it to the CSP; generating the keyword search trapdoor based on the blinded keyword, the public parameter and the pre-decryption key; Performing authority judgment based on the second attribute set, the authoritative amount, and the pre-decryption key, and when the access policy is satisfied, searching and downloading the final ciphertext in the CSP based on the keyword search trapdoor, the public parameter, and the index; Generate the pre-decrypted ciphertext based on the final ciphertext, the public parameter and the pre-decryption key; The keyword search trapdoor and the pre-decrypted ciphertext are sent to the DU.

6. The attribute-based encrypted data sharing system supporting flexible user changes according to claim 5, characterized in that: The data user DU specifically includes: generating the search request based on the keyword search trapdoor; Generate a second attribute set and use the private key; sending the search request and the second attribute set to a PS; The pre-decrypted ciphertext is decrypted based on the private key to obtain the corresponding plaintext.

7. An attribute-based encrypted data sharing method supporting flexible changes by users, applied to an attribute-based encrypted data sharing system supporting flexible changes by users as claimed in any one of claims 1 to 6, characterized in that: include: CA generates public parameters; DO generates a user public key and a first attribute set; CA generates a first key component based on the user public key; The AA generates a pre-decryption key based on the public parameter, the first key component and the first attribute set; DO constructs an access policy and generates an initial ciphertext based on the access policy, the plaintext to be encrypted and the public parameters; PS generates a final ciphertext based on the initial ciphertext and the pre-decryption key and sends it to CSP for storage; The DO generates an index and a blinded keyword based on the plaintext to be encrypted; the PS generates a keyword search trap based on the blinded keyword, the public parameter and the pre-decryption key and sends it to the DU; The DU generates a second attribute set and uses a private key to generate a search request based on the keyword search trapdoor; the AA generates an attribute quantity based on the second attribute set, and the CA generates an authoritative quantity based on the attribute quantity; After receiving the search request, the PS performs permission judgment based on the second attribute set, the authoritative amount and the pre-decryption key. When the access policy is satisfied, the PS obtains the final ciphertext in the CSP based on the keyword search trapdoor, the public parameter and the index, and performs pre-decryption to obtain the pre-decrypted ciphertext. The DU decrypts the pre-decrypted ciphertext based on the private key to obtain the corresponding plaintext; The CA generates the attribute to be revoked and sends it to the AA; the AA generates a new pre-decryption key based on the attribute to be revoked, the pre-decryption key and the public parameter, and updates the key component for the user who has the attribute to be revoked and has not been revoked.

8. The attribute-based encrypted data sharing method supporting flexible user changes according to claim 7, characterized in that: Generate common parameters, including: CA randomly generates security parameters; Running a group generation algorithm based on the security parameter as input, selecting a bilinear group G whose order is a prime number p; Select a prime number q such that gcd(p,q)=1; Based on the prime number p and the prime number q, the intermediate quantity N=pq is obtained; Define X as a global attribute set containing h attributes; Select a first hash function H; Obtain a second hash function H1 based on the global attribute set and the bilinear group G; Randomly select the first parameter α and the second parameter β; The public parameter PP=(β, g, g1) is obtained based on the intermediate quantity N, the first Hash function H, and the second Hash function H2. α ,e(g,g) α ,H,H1,N); Among them, g represents the generator of the bilinear group G, and e represents the bilinear pairing operation.

9. The attribute-based encrypted data sharing method supporting flexible user changes according to claim 7, characterized in that: Generate a pre-decryption key, including: Select a random number c, c∈Z N * ; CA obtains a first key component K1 based on the user public key K, the public parameter and the random number; Each of the attribute authorities calculates the first process quantity K for the first attribute set in the attribute domain managed by each of them 2,d and the second process quantity K 3,d ; Obtaining a second key component K2 based on the first process quantity; Obtaining a third key component K3 based on the second process quantity; Based on the random number c as the fourth key component K4; The pre-decryption key sk is obtained based on the first key component, the second key component, the third key component and the fourth key component id,pre =(K1,K2,K3,K4).

10. The attribute-based encrypted data sharing method supporting flexible user changes according to claim 7, characterized in that: Generate a new pre-decryption key, including: The attribute authority responsible for managing the attribute to be revoked updates the second key component and the third key component based on the public parameter, the pre-decryption key and the attribute to be revoked, respectively, to obtain a second updated key component and a third updated key component accordingly; The second key component and the third key component in the pre-decryption key are replaced based on the second updated key component and the third updated key component to obtain the new pre-decryption key.

Images